yashsingh1/xdaforums huggingface dataset:
[XPERIA X10 Android Development] Nikhil_007:
Sorry, but as far as my communication with max goes, it might b not possible for now as u dont even have access even via jtag... thats just my understanding... considering even if u do... u still have to sought out mess for recognising correct pins... which i think biktor worked on in past(no idea where he is these days:-)) & moreover its no viable or easy method to do..

Wot max was trying was to get full access but the modem comes in d way and maximum he can is reset it, but not to disable d same.. as per his last conversation with me... so kinda tricky for now..sorry sounds dissapointin but i guess thats where v r stuck..

X10i Android 2.1 + JIT...
[XPERIA X10 Android Development] Bin4ry:
Excatly, so even the brown SPL is useless at the moment.

The only thing which can help us is a developer loader.sin, if we get one -> we can do what we want.

If we get a signed developer loader.sin we would be able to send unsigned code and execute it in flashmode state. That's needed to access the bootloader and change it to the brown one we have on harddisk here ;)

So IF olipro and cmonex are willing to help, they have to find a way to get a unsigned loader.sin executed in flashmode, or they have to get a developer loader.sin which is signed with release-keys (it exists in newest Flash_Gordon2 as i have heard from some anonymous ppl. via Directmsg from Twitter, but noone is willing to risc their job and leak it).

So we have done all work before, the last step is to send over our files. This progress was made by many ppl. round here who are working for a very long time on this. Maybe someone new has better ideas, but I think that is the only way to get access via normal methods (JTag is the other one, but it's not as simple as plug JTag on board and have fun, it's hard work too)

Regards

Bin4ry
[XPERIA X10 Android Development] Hawkysoft:
usefull or not? if not u can delete my msg...

https://github.com/sonyericssondev/WebSDK
[XPERIA X10 Android Development] hagisbasheruk:
Flash_Gordon2

Some one is willing http://forums.se-nse.net/topic/50107-flashgordon-ii/
[XPERIA X10 Android Development] hagisbasheruk:
Any Developers wishing to have collaboration go here freenode irc server. #hpcdev or #xda-devs channel 10PM GMT timezone..

Cmonex and Olipro will be there to help

Others welcome but keep quiet and let the developers talk please

Download Xchat http://www.silverex.org/download/ or windows

Linux sudo apt-get install xchat

Open program ,connect to irc.freenode.net server

issue command /join #hpcdev,#xda-dev see you in there
[XPERIA X10 Android Development] Bin4ry:
I think this is the best option. But who know how much money we need :P

I write this guy to see what he wants.

AND i will be in the channel this evening.

Regards

Bin4ry
[XPERIA X10 Android Development] RaDi:
l\oooo/l ~ !
[XPERIA X10 Android Development] Hawkysoft:
check this... included prices...

http://forum.gsmhosting.com/vbb/f164/flashgordon-ii-1013867/
[XPERIA X10 Android Development] diimaan:
you beat me to it hawky! :)

here's one more... //check the last reply from SmartSupport!!!

http://forum.gsmhosting.com/vbb/f163/wanted-flash-gordon-access-payment-ewire-paypal-852108/
[XPERIA X10 Android Development] Shabo09:
h-t-t-p://goo.gl/ZeLtH

you can delete if it's not usable:)
[XPERIA X10 Android Development] :
nice post...

So you are saying we just need to find "brown" sign for loader.sin patch loader.sin so that he uses brown sign and ... stop SAKE communication with amss <--> loader or find checksum string in amss.sin over which amss.sin checks is loader changed so that we don't blow Qfuse in MSM and make brick of phone...
[XPERIA X10 Android Development] Bin4ry:
@blagus:

You are right about this whole phone. I have never said another thing.

So what we are speaking about when we talk about loader.sin is actually nothing more than a signed binary which gets runned and provides s1 flashing protocol.

So maybe it's called S1Loader on other phones (don't know about other phones sorry).

X10 is completely a normal S1 phone , just like Vivaz and others. Totally true.

I can provide you boot.img etc. but this files all are android standard images files.

You can get a overview of boot.img here : http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images

Sin header is more or less nothing else like a signature.

Loaderfiles: http://dl.dropbox.com/u/17170888/loaders.zip

SPL: http://dl.dropbox.com/u/17170888/spl.rar

Maybe this helps you.If you have more quesions related to the phone. We can speak via PM if you like.

Regards

Bin4ry
[XPERIA X10 Android Development] MrHassell:
is it possible someone could issue the keys posted to the Bruteforce thread against the bootloader to decrypt? if i'm not mistaken the key and the cert should be able to decrypt the bootloader - right?
[XPERIA X10 Android Development] MrHassell:
private engineering key

how about issuing the private engineering key and cert? download here
[XPERIA X10 Android Development] Blagus:
This is engineering key - if I'm right, engineering=brown so it's not very useful at the moment - first we have to find a way to make bootloader (bootloader=S1Boot=EROM, from what I've understood so far) accept brown signed file, and then we could sign all files with that key, until SE traditionally makes update that will prevent us from doing that.

Note to all developers: I'm sure SE is looking at this thread. And they'll traditionally now rush to see if this can be done. If so, they'll fix it even before we make it, so I would suggest that prior to applying next update, someone first checks loader.sin to see if anything is changed (I can ask my source for help about that, maybe he knows that).

SE did this a lot of times in the past, with constantly making new CIDs and AIDs after they were cracked.

Although this process of improving security is a bit slow, I still recommend you to be a bit careful with new updates that might "accidentaly" pop out marked as "critical".
[XPERIA X10 Android Development] zdzihu:
Hi blagus,

Please get in touch with McKebapp, who's hosting a X10 developers' forum. I guess there's a lot to discuss in this matter.

And yes, we realise that big brother is watching :)

Cheers,

z
[XPERIA X10 Android Development] MrHassell:
Can only be 'done' as far as I can tell, against a source build from gcc make file provided in se source. Both sources and brown key in topic are available from se development site. Retail is different somehow :-D

We need retail sources for 2.4 se, anyway you are able to oblige? Were all aware se monitors our progress and that maybe reason why certain 'flaws' exist, purely @ development level? Just a thought..
[XPERIA X10 Android Development] Blagus:
No, possibility of writing "anything" on development level is not a flaw - it's actually a feature: it's made that way.

Flaw would be when a way of writing brown and/or unsigned flashes is found on Red phone.

No, we don't need "Red sources" - basically because sources for brown and red signed flashes are the same - we actually need red retail key. That would be one of the ways into modifying bootloader.

However, bootloader can also be made "brown" with some authentications and special SE signed loaders (said by my source).

So, probably easiest way of doing that would be getting Red key (right now we have only engineering one) and use it to sign patched EROM image (loader.img), to produce loader.sin.
[XPERIA X10 Android Development] Bin4ry:
Anyone wants to try my modded kexec-tool? I hope i have found a solution, but don't know yet, because my netbook still compiles the kernel ..... (for another 20 hours :P )

Regards

Bin4ry
[XPERIA X10 Android Development] Bin4ry:
Since Maxrfon didn't answered my last mail again (he's very busy now) i had spare time and worked on this little tool once more =)

I hope we can boot another kernel with kexec-tool now.

for that we need a zImage and a initrd + some bootparameters for the kernel (root partition)

So if anyone want to try i would be lucky. My compilation was broken and now i have to start again :'(

So i anyone here wants help to try i would be lucky =)

Regards
[XPERIA X10 Android Development] kloud_:
Will give it a shot, please be patient as I blew my laptop's display last night. Might take a while. :p

Or will try at the college's dev lab ;) :p
[XPERIA X10 Android Development] Blagus:
I've tried it on my X8 but it doesn't have shutdown on phone :S so it fails...

Edit: when i try with -f it hangs, and reboots but nothing is changed... I tried with complied zimage with multitouch driver...

I've put zImage in / with chmod 777 and when I try kexec-tool (located in /system, chomd 777)

kexec-tool -f /zImage

it reboots immediately, but kernel remains the same... do I need initrd, or something (also, as I said, shutdown command doesn't exist on phone...)?
[XPERIA X10 Android Development] sephirothusi:
Please read this carefully. ;)

Cheers.
[XPERIA X10 Android Development] Bin4ry:
Yes a initrd is needed, because i have not found the initrd location in virtual memory now, so i cannot point to it from kexec :D

kexec -l /zImage --apend="root........" --file="/initrd"
kexec -e -f

also you should appen the root partition.

It would be nice if someone could upload a zImage, i'm still stuck in compiling it *LoL* ****ing netbook is compiling 15 hours and then it aborts with some errors :D ^^

Regards
[XPERIA X10 Android Development] Blagus:
you have one in "multytouch firmware" thread in x8 android development ;)

Okay, I'll try that, thanks :)
[XPERIA X10 Android Development] wolfilein:
for all who don't find it its here:

http://xdaforums.com/showthread.php?t=907736&page=10
[XPERIA X10 Android Development] Blagus:
Where do I get initrd from? Sorry for bothering but right now I have very slow internet so googling around is a bit hard :/
[XPERIA X10 Android Development] Bin4ry:
ramdisk from 1.6 X10i bootimg.

http://dl.dropbox.com/u/17170888/ramdisk_orig.tgz

I think its a good base to work on =)

Regards
[XPERIA X10 Android Development] Blagus:
Thanks ;)

I've put zImage and your initrd to / and chmodded them to 777, appended to "/" and it loaded. When I executed it (-e) it rebooted but dammit, I can't know is the new kernel loaded because stock and compiled kernels are both 2.6.29.

Only difference is that this compiled one is supposed to have MT but again, I can't use that fact to confirm is kernel loaded or not because maybe MT is not supported in current FW version (2.0.2.A.0.24)...

How can I check is it executed succesfully or not? Or, has anyone got different zImage with different kernel version?
[XPERIA X10 Android Development] Shaumux:
@blagus:

You can use dmesg to check the time of compilation or change the version string to something else to confirm
[XPERIA X10 Android Development] Blagus:
dmesg gives too much info and I can't scroll to top to see it's complete output. Are there any parameters for it?

Anyways, looks like I got it booting because now when I put both fingers on screen, although MT Visualizer registers only one, it registers movement across the screen when moving both fingers on same Y position. (Nah, it's just a flaw, it thinks that finger is moving left-right-left-right across the edges.
[XPERIA X10 Android Development] wolfilein:
how load you the kernel

because my phone only freeeze when i load kernel

no reboot !
[XPERIA X10 Android Development] Blagus:
Put kexec in /system, chmod 777

Put ramdisk_orig.tgz and zImage to / and chmod 777

# kexec-tool -l /zImage --append="/" --initrd="/ramdisk_orig.tgz"
# kexec-tool -fe

After reboot zImage and initrd dissapear from /

Maybe if I put them in /system... I'll try that and let you know result.
[XPERIA X10 Android Development] Shaumux:
@Blagus:

I don't think there are any parameters.

The amount of information stored is dependant on the size of the buffer specified in the config.

You have to try dmesg right after starting the phone to see it.

You could still try changing the version string.

@Bin4nary:

Herers a compiled .435 kernel.

and also the .config i used.

I appended -shaumux to the version string for easy detection
[XPERIA X10 Android Development] Blagus:
That config file - where do I put it? And then, what's the exact append command?

Sorry, but I'm not very good with Linux, and, again, my connection is very slow at the moment so it's quite slow to google the info...
[XPERIA X10 Android Development] Shaumux:
The version string can be appended from the menuconfig

General setup --->

[*] Prompt for development and/or incomplete code/drivers
($(KERNEL_LOCAL_VERSION)-shaumux) Local version - append to kernel release

You can change it to whatever you like.

As for the .config.

it goes in the kernel directory.

put it there run

make ARCH=arm CROSS_COMPILE=/somewhere in your hdd/prebuilt/linux-x86/toolchain/arm-eabi-4.4.0/bin/arm-eabi- oldconfig

to use the config.
[XPERIA X10 Android Development] wolfilein:
so that i've seen on my device say that it doesnt work may i'm wrong.
[XPERIA X10 Android Development] Blagus:
I've removed original kexec from /system/bin/ and put Bin4ry's one.

Then tried this:

# kexec-tool -l /system/zImage --append="-shaumux" --initrd="/system/ramdisk_orig.tgz"
# kexec-tool -e

I've also tried ramdisk insted of initrd (as Bin4ry written in first post) and -fe instead of -e but I guess nothing - because still there's no multitouch (and I've also put that MT config file in /etc and put MT lines in build.prop so with correct kernel it should work). And about dmesg, it's impossible to get beggining of log, no matter how fast I execute it...
[XPERIA X10 Android Development] Bin4ry:
@Shamux thanks for the kernel.

@blagus:

You have to append the root partition to kernel parameters, else it will not detect it!

It's just like you want to boot a normal kernel on pc :)

Try adding --append="root=/dev/blablabla rw"

check which one is root partition (don't know now) and then check again if it works.

What we really neew is some kmsg log or smth.

Also Z mentioned to compile the kernel with semc-es209ra-capk config.

A minimal config will be a better way to start because something is breaking up we cannot find it.

But if we can boot minimal kernel, we can try to add more and more step by step and find the problem =)

Regards
[XPERIA X10 Android Development] Blagus:
Hmm... then, a little bit of experimenting is required...

I've got new info regarding bootloader cracking, from my source again ;)

In theory it's very simple and you probably know that already: we calculate prime numbers that public key is made from - one key is enough, second can be calculated with

key ÷ 1st prime formula. But, you already know that.

Now, how to get these keys? Probably you know that too but let me repeat:

with OpenSSL we can get certificates from loader.sin. For example, this is interesting part of S1_loader_root (root certificate):

Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:ea:a5:f7:7d:bd:67:21:33:04:00:ea:91:b0:c6:
cd:38:6c:aa:da:60:c1:77:e2:24:67:be:b7:da:4f:
e6:e5:92:fd:5b:b4:1a:97:54:cb:2f:7d:b1:63:e3:
d4:43:b9:a6:91:70:36:9f:5f:3a:7a:0e:2c:a7:44:
3b:40:84:0f:40:79:4a:b7:e8:58:d7:47:15:29:79:
07:b7:65:7b:d3:6d:40:10:29:78:c5:8f:51:b0:6e:
38:a9:97:1c:ff:1e:e5:bc:0d:22:1c:08:22:db:ad:
40:6f:2f:28:8a:8f:5c:38:d3:2a:96:72:48:66:28:
07:80:11:f1:62:f9:d3:40:a7
Exponent: 65537 (0x10001)

Modulus here is public key.

Just give this modulus to the CPUs and GPUs and let them calculate primes.

With these primes, calculation of private key should be trivial.

Update: this key is what we need to crack, that's it. Then, we can even make our own certificate - just like now there are, for example, s1_loader (Red, retail) and s1_loader_test (Brown, developer), we can make our own s1_loader_xda... and then, if it's issuer is S1_Loader_Root_f851 (like it is in root certificate attached here), and it is present in all parts of loader.sin (signature, signature of loader payload data) then phone will accept it.

Yes, that's right: this "Modulus" number above is the one that we need to crack in order to modify bootloader.

Update: if there's something confusing in this certificate, it's probably the fact that it's issuer and subject are same: yes, it's self-signed. But unfortunately, it won't work if we make our self-signed certificate :p
[XPERIA X10 Android Development] wolfilein:
@ bin4ry

is the root partition one of th e hidden mtd partitions ?
[XPERIA X10 Android Development] u-ra:
blagus, you can pipe the dmesg output to more, if you have busybox. Like this:

dmesg | busybox more
[XPERIA X10 Android Development] wolfilein:
@ bin4ry

isn't that an kmsg:

cat /proc/kmsg
[XPERIA X10 Android Development] Blagus:
Thanks a lot, that's what I was looking for!

Now I see that kernel remained the same, but as Bin4ry said, we have to find root where we append kernel, but this will help me once we do that ;)

Hvala!
[XPERIA X10 Android Development] xdZKu7:
blagus, if you know what you're looking for you can also use grep:

dmesg | grep suspend

Or you can direct the output to a file to browse through it on your computer:

dmesg > /sdcard/dmesgoutput.txt

> to clear file before write

>> to append to the end of the file
[XPERIA X10 Android Development] arkedk:
Don't know if this is any help or useful info for any of the devs.

But managed to check the code in the lib_s1_verification.so file

Here's the boot sequence.

These files is what I know has something to do with the s1:

/lib/lib_s1_verification.so

/bin/linker

/bin/s1_verification_test

I don't know what I'm looking at here, but just wanted to see if I could make some kind of contribution to get the bootloader opened up.

Also attached the dedexed files from within semc_bootinfoif.jar if those are useful to anyone.

Assuming this is the Booting Sequence:
[XPERIA X10 Android Development] Hawkysoft:
Maybe it sounds stupid but couldnt we JMP one of the init parts to bypass the check? Or are these the wrong files for the check?

Send from my custom X10/2.1 using XDA App
[XPERIA X10 Android Development] Blagus:
As I said before, correct boot sequence is:

ROM -> EROM (S1Boot/bootloader) -> firmware

This SHA1 checks are probably between EROM and firmware (because firmware has nothing to do with ROM). However, this might be also useful, especially if these checks are for OTA updates ;)
[XPERIA X10 Android Development] nobodyAtall:
Hi Bin4ry,

I've tried this on my x10 mini using your modded tool, with a ramdisk_orig.tgz posted earlier on this thread and a custom build of mine of the SE posted kernel:

root@localhost download # ./kexec-tool -l ./zImage --command-line="init=/init root=/dev/block/mtdblock0 rw rootfs=yaffs2" --ramdisk=./ramdisk_orig.tgz
-=| Bin4ry modded kexec-tool |=-
Memory Ranges: range[0].start = 0x200000
Memory Ranges: range[1].start = 0xd200000
*initrd_start = 0xd600000
root@localhost download # sync
root@localhost download # ./kexec-tool -e
-=| Bin4ry modded kexec-tool |=-

Device simply hangs and reboots after a while (some watchdog timer kicks in probably).

Is there any way to get some logging of what's going on during the kexec call?
[XPERIA X10 Android Development] sim-value:
@jerpealea the recovery_console_boot.img should work with goroh_kun's method, right?

Because it always gives me an invalid image error and then stays stuck at "booting linux"
[XPERIA X10 Android Development] jerpelea:
that metod is incomplete

will not boot anything
[XPERIA X10 Android Development] sim-value:
aw ok, sry
[XPERIA X10 Android Development] Bin4ry:
Here is nothing to work at the moment. Patience please :)

Regards

Bin4ry
[XPERIA X10 Android Development] goroh_kun:
fastboot version up

Hi, all

I updated new splboot module, and usbloader(fastboot host)

now, you can send boot.img from the original kernel.

http://hotfile.com/dl/54823374/b92833f/splboot_5.zip.html
[XPERIA X10 Android Development] Bin4ry:
Thanks for that :) More to try now ;)

Regards
[XPERIA X10 Android Development] goroh_kun:
thanks, please :)

if you don't use kernel module parameter, like

bootparam, serialno, default value is used.

bootparam is used usbloader's parameter, and serialno is "S12345".

if you want use real serialno, you can use this command.

cat /proc/cmdline | awk '{print $1}' | sed 's/.*=//'

:)
[XPERIA X10 Android Development] jerpelea:
cyanogen is ready

started porting se changes from 2.6.29 kernel to 2.6.32
[XPERIA X10 Android Development] MarylandCookie:
Its cyanogen 6 RC1. :D (thanks to jerpelea)

(http://github.com/CyanogenMod/android_vendor_cyanogen/blob/froyo/CHANGELOG.mkdn)
[XPERIA X10 Android Development] cvchetan:
Custom rom development : Devs only

Custom rom development : Devs only:

non dev discussion shall be deleted without warning.

thread stickied..
[XPERIA X10 Android Development] jerpelea:
here it is Cyanogen v6 RC1 v000001 alpha

this is not for daily use but will help us boot an custom rom

there will be time for fixing those but now we have "what to boot" from custom loader

NOT WORKING - TEST YOURSELF AND HELP ME FIX (or at least report the error)

HOWTO BOOT - if you are unable to boot it don't ask questions search forum and figure out

http://hotfile.com/dl/55119548/8c313c6/cyanogen_v00001_alpha.zip.html

THIS BUILD IS NOT DUMPED FROM OTHER DEVICE

IS COMPILED FROM CYANOGEN SOURCES (credits go to cyanogen)

I HAVE ADDED ALL X10 CODE AND SCRYPTS (hope to merge them with cyanogen tree)
[XPERIA X10 Android Development] tewilove:
hi, goroh_kun, i tried to make splboot work on armv6 machines like htc tattoo, but unfortunately i can't find an address which maps to physical address of the original spl(0x8d000000). any ideas to find out it or i think i have to use usbloader or manually relocate spl image...
[XPERIA X10 Android Development] HunteronX:
I know that you said not to ask questions about booting the rom, but the 'boot.img' file seems to be of an incorrect size. I tried to boot it, but the message "bootimg: Invalid image size"

kernel_size = 00245000

kernel_actual = 0021c000

calced kernel_size = 00246000

I used goroh_kun's 'splboot5' method to do this.

Thanks for your work, by the way. I hope this helps. :)
[XPERIA X10 Android Development] biktor_gj:
The usbloader still needs a lot of work, im still unable to boot anything as it seems to halt acpu when attempting to boot something...and baseband seems to crash when you splboot....
[XPERIA X10 Android Development] jerpelea:
this rom is intended for us developers to tweak spl loader
[XPERIA X10 Android Development] HunteronX:
Ok, then. Thanks. :)

I won't post here anymore unless I have anything helpful to say.
[XPERIA X10 Android Development] Umeaboy:
I got an idea. Why not try to ssh to the phone when you've found which ports that are active?

A friend of mine portscanned my phone & gave me following output:

nmap -sS -A XXX.XXX.XXX.XXX

Starting Nmap 5.00 ( http://nmap.org ) at 2010-07-16 20:47 CDT

Interesting ports on XXX-XXX-XXX-XXXX.XXXX.XXXX.XXX (XXX.XXX.XXX.XXX):

Not shown: 996 closed ports

PORT STATE SERVICE VERSION

25/tcp filtered smtp

135/tcp filtered msrpc

445/tcp filtered microsoft-ds

1900/tcp filtered upnp

Too many fingerprints match this host to give specific OS details

Network Distance: 22 hops

If you can use some of this info about the ports, maybe we'll get a step forward.
[XPERIA X10 Android Development] zephyrix:
what the hell is ssh access going to do? sorry but that's completely useless. we already have root.